Pinkbyte/pinkbyte-overlay
1
Fork 0
Code Releases Activity

improve snortsam-redirect patch and update snort ebuild

Browse Source
This commit is contained in:
Sergey Popov 2012-05-25 15:57:58 +04:00
parent 47a7ee975d
commit 71142d8df2
3 changed files with 43 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net-analyzer/snort/Manifest
View File

@ -1,7 +1,7 @@
AUX snort.confd.2 420 RMD160 66bead70bfb5752d7f9779803453bdecf2694fee SHA1 d4917da66def50d09430a0dff4b2e86103a4834a SHA256 337378f098e0cd59fb5c28a26b5b74b32168cf48596064469e6a5ba04fe3a36f
AUX snort.rc11 1473 RMD160 f9d1a9bfbe88b0bcb5dbecbab3ee3fc647f0a9ff SHA1 cf97f12c9560b85d6ac12492020c5222eb4613b3 SHA256 280ed4fb18c871ca83469a4dd1485f47d422b9d4476613711707c627176e4774
AUX snortsam-2.9.2.2.diff.gz 28987 RMD160 b09a856bffa47300d3421029ce55375e96eeadf1 SHA1 403ffb76323be7ffee57062fad0cfd61cce755ab SHA256 61c6104778a1cd2d0795be0a7b3d67460955e5ffab392852a930b167c1fe27f2
AUX snortsam-redirect-2.9.2.2.patch 2370 RMD160 e289bee7423286d287d876792bc47ea6e447cd11 SHA1 00e35d6c10f8eb61b2d348567d9d1fbee931a2aa SHA256 f5111fce50d5578446bd4eb788a9d974ee4ee3c3a27c8e3e2e5a148c59491d3c
AUX snortsam-redirect-2.9.2.2.patch 3907 RMD160 dc702bc139d8664a47b6df4697acb341937fe034 SHA1 42b151f7285b387a27bc41180885417a0be87b80 SHA256 1af33876ab2b2ce808ce33a9e31a786dcd334a9396d267825fcbf7470c30b8f5
DIST snort-2.9.2.2.tar.gz 6529966 RMD160 2c5f3d9d28de860f906c6f229721833b856705c8 SHA1 5b1e9bd527ecba7e42c007ae1a62ff51a4adb2c6 SHA256 63f4eeee24d79e4a4e4b573e085d0d2fd78fcf3b7ea730c37eab7b47fcd9b954
EBUILD snort-2.9.2.2-r9999.ebuild 9536 RMD160 6eaa6ccae82ac0e752316a646f3c16b094e40354 SHA1 3d8e60f92a7aba3150427446244aeb8625ccbdea SHA256 bad1c917896d45db4649ce70d7003e1e46e5490c9bd8b6820d7eb3186c398f44
EBUILD snort-2.9.2.2-r9999.ebuild 9568 RMD160 6573be2b00c201431edde95d03bb0bce400fb927 SHA1 a8a27b549c56897dfae67a4e45ffd6c11f245bb8 SHA256 997e3d13bcb005114b65f400d59cb09b2b51979f26dd8da97815740877565f31
MISC ChangeLog 33624 RMD160 a39244fe968467d72330e62b4e54aaae363a650f SHA1 767a852c3f3a1e3905406ebed2da5b138ff0b543 SHA256 b9d25fcbc4f88b0aa35f78dfd776fa1a673461f4e20fa19a2245e0ac703b0f25

42
net-analyzer/snort/files/snortsam-redirect-2.9.2.2.patch
View File

@ -1,7 +1,25 @@
diff -ur snort-2.9.2.2-snortsam/src/output-plugins/spo_alert_fwsam.c snort-2.9.2.2/src/output-plugins/spo_alert_fwsam.c
--- snort-2.9.2.2-snortsam/src/output-plugins/spo_alert_fwsam.c 2012-05-20 18:33:57.271278999 +0400
+++ snort-2.9.2.2/src/output-plugins/spo_alert_fwsam.c 2012-05-20 19:18:47.383364414 +0400
@@ -515,6 +515,7 @@
+++ snort-2.9.2.2/src/output-plugins/spo_alert_fwsam.c 2012-05-25 15:56:24.138470000 +0400
@@ -456,10 +456,16 @@
/* Parses the duration of the argument, recognizing minutes, hours, etc..
*/
-unsigned long FWsamParseDuration(char *p)
+unsigned long FWsamParseDuration(char *param)
{ unsigned long dur=0,tdu;
char *tok,c1,c2;
+ // Protect input string from overwriting it
+ char tmpp[20];
+ strncpy(tmpp,param,19);
+ tmpp[19]=(char)0;
+ char* p=tmpp;
+
while(*p)
{ tok=p;
while(*p && isdigit(*p))
@@ -515,6 +521,7 @@
optp->how=FWSAM_HOW_INOUT; /* inbound and outbound block */
optp->who=FWSAM_WHO_SRC; /* the source */
optp->loglevel=FWSAM_LOG_LONGALERT; /* the log level default */
@ -9,7 +27,7 @@ diff -ur snort-2.9.2.2-snortsam/src/output-plugins/spo_alert_fwsam.c snort-2.9.2
/* parse the fwsam keywords */
#ifdef FWSAMDEBUG
@@ -566,6 +567,17 @@
@@ -566,6 +573,17 @@
optp->duration=0;
else
possprob=TRUE;
@ -27,7 +45,7 @@ diff -ur snort-2.9.2.2-snortsam/src/output-plugins/spo_alert_fwsam.c snort-2.9.2
}
else if(!*ap)
possprob=TRUE;
@@ -879,7 +891,7 @@
@@ -879,7 +897,7 @@
sampacket.snortseqno[1]=(char)(station->myseqno>>8);
sampacket.fwseqno[0]=(char)station->stationseqno;/* fill station seqno */
sampacket.fwseqno[1]=(char)(station->stationseqno>>8);
@ -36,6 +54,22 @@ diff -ur snort-2.9.2.2-snortsam/src/output-plugins/spo_alert_fwsam.c snort-2.9.2
sampacket.version=FWSAM_PACKETVERSION; /* set packet version */
sampacket.duration[0]=(char)optp->duration; /* set duration */
sampacket.duration[1]=(char)(optp->duration>>8);
@@ -912,10 +930,13 @@
sampacket.sig_id[3]=(char)(event->sig_id>>24);
#ifdef FWSAMDEBUG
- LogMessage("DEBUG => [Alert_FWsam] Sending BLOCK\n");
+ if (optp->action==FWSAM_STATUS_REDIRECT)
+ LogMessage("DEBUG => [Alert_FWsam] Sending REDIRECT\n");
+ else
+ LogMessage("DEBUG => [Alert_FWsam] Sending BLOCK\n");
LogMessage("DEBUG => [Alert_FWsam] Snort SeqNo: %x\n",station->myseqno);
LogMessage("DEBUG => [Alert_FWsam] Mgmt SeqNo : %x\n",station->stationseqno);
- LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",FWSAM_STATUS_BLOCK);
+ LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",optp->action);
LogMessage("DEBUG => [Alert_FWsam] Mode : %i\n",optp->how|optp->who|optp->loglevel);
LogMessage("DEBUG => [Alert_FWsam] Duration : %li\n",optp->duration);
LogMessage("DEBUG => [Alert_FWsam] Protocol : %i\n",GET_IPH_PROTO(p));
diff -ur snort-2.9.2.2-snortsam/src/output-plugins/spo_alert_fwsam.h snort-2.9.2.2/src/output-plugins/spo_alert_fwsam.h
--- snort-2.9.2.2-snortsam/src/output-plugins/spo_alert_fwsam.h 2012-05-20 18:33:57.270278999 +0400
+++ snort-2.9.2.2/src/output-plugins/spo_alert_fwsam.h 2012-05-20 19:02:01.695332482 +0400

6
net-analyzer/snort/snort-2.9.2.2-r9999.ebuild
View File

@ -3,7 +3,7 @@
# $Header: /var/cvsroot/gentoo-x86/net-analyzer/snort/snort-2.9.2.2.ebuild,v 1.1 2012/04/04 09:39:53 patrick Exp $
EAPI="2"
inherit eutils autotools multilib
inherit eutils autotools flag-o-matic multilib
DESCRIPTION="The de facto standard for intrusion detection/prevention"
HOMEPAGE="http://www.snort.org/"
@ -63,6 +63,7 @@ src_prepare() {
if use snortsam; then
epatch "${FILESDIR}/snortsam-${PV}.diff.gz"
epatch "${FILESDIR}/snortsam-redirect-${PV}.patch"
use debug && append-flags "-DFWSAMDEBUG"
fi
#
@ -109,8 +110,7 @@ src_configure() {
--disable-intel-soft-cpm \
--disable-static-daq \
--disable-rzb-saac \
--without-oracle \
--enable-sourcefire
--without-oracle
}
src_install() {